To guarantee delivery of their intended functionalities in the presence of unresponsive parties, current smart-contracts cut users off from being able to commit their responses after a fixed period of time has elapsed. However, current blockchains have limited transaction processing capacities, so a fixed amount of time will not always be sufficient to receive every critical transaction (C-TX). This paper presents a mechanism for adaptive cutoffs (ACs) which ensures that users retain the opportunity to commit C-TXs despite blockchain congestion, and enables early cutoffs when the number of required C-TXs is low. A non-interactive argument system for setting adaptive cutoffs under the current Ethereum Virtual Machine is described. Additionally, disputable cutoffs (DCs) are presented, which are a more efficient approach used in parallel to ACs based on a bisection-based dispute. Furthermore, it’s empirically demonstrated that an AC/DC-enabled smart-contract can receive a larger number of C-TXs than its non-adaptive counterparts when user responsiveness is slowed due to denial of service or congestion.

Macro-programming advocates the use of high-level abstractions to specify distributed systems as a whole. However, macro-programming implementations are often centralised. In this paper we present PICO-MP, the first fully decentralised macro-programming middleware for wireless sensor and actuator network (WSAN) applications. PICO-MP incorporates a novel publish-subscribe service that can correlate events scattered across a WSAN using global formulae specifications that are automatically checked in a distributed fashion. PICO-MP has been implemented for the TinyOS operating system and validated on a case study that uses global formulae to improve energy efficiency (lifetime) of the implementation.

Short term studies in controlled environments have shown that user behaviour is consistent enough to predict disruptive smartphone notifications. However, in practice, user behaviour changes over time (concept drift) and individual user preferences need to be considered. There is a lack of research on which methods are best suited for predicting disruptive smartphone notifications longer-term, taking into account varying error costs. In this paper we report on a 16 week field study comparing how well different learners perform at mitigating disruptive incoming phone calls.

Access control policies define what resources can be accessed by which subjects and under which conditions. It is, however, often not possible to anticipate all subjects that should be permitted access and the conditions under which they should be permitted. For example, predicting and correctly encoding all emergency and exceptional situations is impractical. Traditional access control models simply deny all requests that are not permitted, and in doing so may cause unpredictable and unacceptable consequences. To overcome this issue, break-glass access control models permit a subject to override an access control denial if he accepts a set of obligatory actions and certain override conditions are met. Existing break-glass models are limited in how the override decision is specified. They either grant overrides for a predefined set of exceptional situations, or they grant unlimited overrides to selected subjects, and as such, they suffer from the difficulty of correctly encoding and predicting all override situations and permissions. To address this, we develop Rumpole, a novel break-glass language that explicitly represents and infers knowledge gaps and knowledge conflicts about the subject's attributes and the contextual conditions, such as emergencies. For example, a Rumpole policy can distinguish whether or not it is known that an emergency holds. This leads to a more informed decision for an override request, whereas current break-glass languages simply assume that there is no emergency if the evidence for it is missing. To formally define Rumpole, we construct a novel many-valued logic programming language called Beagle. It has a simple syntax similar to that of Datalog, and its semantics is an extension of Fitting's bilattice-based semantics for logic programs. Beagle is a knowledge non-monotonic langauge, and as such, is strictly more expressive than current many-valued logic programming languages.

As the complexity and size of home networks increases, so does the need for better management support for nonexpert home users. In this paper we describe an extensible policy-based configuration service that allows the home networking infrastructure to be viewed, verified and reconfigured at a higher-level of abstraction. The aim is to ensure that configuration changes in network infrastructure do not result in erroneous setups and to allow intuitive user-centric tools to operate at a higher-level of abstraction. Our implementation compiles configuration tasks to host/device level commands and supports deployment to multiple heterogeneous devices. We demonstrate and evaluate our approach using access control and bandwidth sharing as two examples of home management tasks.

Home networks have evolved to become small-scale versions of enterprise networks. The tools for visualizing and managing such networks are primitive and continue to require networked systems expertise on the part of the home user. As a result, non-expert home users must manually manage non-obvious aspects of the network - e.g., MAC address filtering, network masks, and firewall rules, using these primitive tools. The Homework information plane architecture uses stream database concepts to generate derived events from streams of raw events. This supports a variety of visualization and monitoring techniques, and also enables construction of a closed-loop, policy-based management system. This paper describes the information plane architecture and its associated policy-based management infrastructure. Exemplar visualization and closed-loop management applications enabled by the resulting system (tuned to the skills of non-expert home users) are discussed.

Access control operates under the assumption that it is possible to correctly encode and predict all subjects' needs and rights. However, in human-centric pervasive domains, such as health care, it is hard if not impossible to encode all emergencies and exceptions, but also to imagine a priori all the permissible requests. Break-glass is an approach that em- bodies the idea that under certain conditions it is possible for a subject to break-the-glass and explicitly override the denied request. Current break-glass models make this decision without considering and investigating what the reasons for issuing the denial are, and they have a fixed decision procedure to determine whether the override is permitted. Furthermore, they do not explicitly represent and reason over conflicting and missing information about subjects and the context; which in human-centric pervasive domains is a norm rather than an anomaly. This paper presents a novel break-glass model, Rumpole, that structures a break-glass policy by establishing why the access was denied. It uses Belnap's four-valued logic to represent conflicting and missing (unknown) information, allowing the policy to make a more informed decision when faced with missing or inconsistent knowledge. The model also provides a declarative query language that is used to specify an explicit break-glass decision procedure, rather than having an implicitly hard-coded one. This allows a policy writer to further condition and restrict when and how break-glass access is permitted.

Current security mechanisms are not suitable for organisations that outsource their data management to untrusted servers. Encrypting and decrypting sensitive data at the client side is the normal approach in this situation but has high communication and computation overheads if only a subset of the data is required, for example, selecting records in a database table based on a keyword search. New cryptographic schemes have been proposed that support encrypted queries over encrypted data. But they all depend on a single set of secret keys, which implies single user access or sharing keys among multiple users, with key revocation requiring costly data re-encryption. In this paper, we propose an encryption scheme where each authorised user in the system has his own keys to encrypt and decrypt data. The scheme supports keyword search which enables the server to return only the encrypted data that satisfies an encrypted query without decrypting it. We provide a concrete construction of the scheme and give formal proofs of its security. We also report on the results of our implementation.

Pervasive systems are increasingly being designed using a service-oriented approach where services are distributed across wireless devices of varying capabilities. Service orchestration is a simple and popular method to coordinate web-based services but introduces a single point of failure and lacks the flexibility to cope with the greater variability of pervasive environments. Choreography in contrast advocates explicitly modelling systems as interacting peers that conform to rules of interaction. Choreography offers greater reliability and flexibility but leads to systems that are much harder to validate. In this paper we describe a novel intermediate approach, where given a logically centralised service orchestration, we automatically generate a distributed implementation that correctly enforces the orchestration behaviour. Our system handles all the synchronisation and consensus issues and ensures correctness. The system also incorporates a number of abstractions for grouping pervasive peers and coordinating pervasive peer-to-peer interactions.

Event-Condition-Action (ECA) policies are often used to manage various aspects of adaptation and execution of pervasive systems. Such policies are well suited for services where: 1) given actions are reliably executed when they are requested, 2) there is no priority ordering amongst multiple available actions, and 3) execution is instantaneous with respect to the validity of conditions under which they were initiated. However, for a pervasive service that integrates human agents and human activities, these assumptions do not generally hold. Humans may misbehave by postponing the execution of certain actions or ignoring them all together. Performing an action may take a long time so that the action is no longer needed or more important actions may need to be executed. Managing such behaviours through ECA policies is complex and difficult to implement. This paper introduces a new management policy type, called a Teleo-Reactive policy, whose semantics are based on continuous monitoring of the environment and prioritising available actions. The semantics result in more flexible and concise formulation of management policies for human-centric pervasive services. We demonstrate how these policies can be applied in a real-world use case scenario set in a nursing home and describe the underlying implementation based on the Android's Java platform.

The mobile phone offers a unique opportunity to predict a person's behaviour automatically for advanced ubiquitous services. In this note, we analyse cellular data collected as part of the Reality Mining project and use information-theoretic concepts to answer three questions (i) What time points in the day help predict a mobile phone user's activity at another time point? (ii) What time points in history are most useful to predict his future activities? and (iii) How difficult is it to predict his activity at a given time from another user's activity at another time?

This dissertation presents a distributed denial-of-service adaptive response (DARE) system, capable of executing appropriate detection and mitigation responses automatically and adaptively according to the attacks. It supports easy integration of distributed modules for both signature-based and anomaly-based detection. Additionally, the innovative design of DARE's individual components takes into consideration the strengths and weaknesses of existing defence mechanisms, and the characteristics and possible future mutations of DDoS attacks. The distributed components work together interactively to adapt detection and response according to the attack types. Experiments on DARE show that the attack detection and mitigation were successfully completed within seconds, with about 60% to 86% of the attack traffic being dropped, while availability for legitimate and new legitimate requests was maintained. DARE is able to detect and trigger appropriate responses in accordance to the attacks being launched with high accuracy, effectiveness and efficiency. The dissertation is available at http://pubs.doc.ic.ac.uk/VrizlynnThing-PhD-Thesis-2008/VrizlynnThing-PhD-Thesis-2008.pdf.

In this paper we draw a methodological connection between human routine classification and the sequence alignment problem in bioinformatics. We first observe that human days exhibit important time shifts and therefore align them for comparison prior to classification. Our technique is evaluated on bimodal data including GSM and Bluetooth information collected on mobile phones. The introduction of new alignment features is found to significantly improve the accuracy of routine classification.

In this paper, we present xDUCON a framework for coordinating and enforcing usage control policies across different collaborating organisations. xDUCON allows the specification of usage control policies that concisely capture conditions, authorisations, and obligations on both providers and consumers of resources. The xDUCON framework is based on the Shared Data Space (SDS) abstraction, where collaborating organisations share a data space containing tuples representing subjects, resources and usage policies. The SDS allows the coordination of the decision and enforcement points abstracting from the details of the actual deployment of the framework. As a consequence, xDUCON supports policies able to express richer and finer constraints compared to previous usage control models. Policies support entity mutability that is the changing of related subject and target attributes due to accesses being executed. The decision and enforcement points support ongoing control over long-lived sessions to evaluate the access rights of a subject while the access is being executed. If the context under which the rights were granted changes, xDUCON is able to revoke the access rights preventing the subject to use any longer the resource.

Many missions are deemed dangerous or impractical to perform by humans, but can use collaborating, self-managing unmanned autonomous vehicles (UAVs) which adapt their behaviour to current context, recover from component failure or optimise performance. This paper describes a policy-based distributed self-management framework for both individual and teams of UAVs. We use three levels of specifications - policy, mission class and mission instance to enable reuse of both policies and mission classes. The architecture has been tested on devices ranging from small laptops to body area networks. Initial evaluation shows the distributed architecture is scalable and outperforms a centralised mission management scheme.

Policy-based management provides the ability to (re-)configure differentiated services networks so that desired Quality of Service (QoS) goals are achieved. This requires implementing network provisioning decisions, performing admission control, and adapting bandwidth allocation to emerging traffic demands. A policy-based approach facilitates flexibility and adaptability as policies can be dynamically changed without modifying the underlying implementation. However, inconsistencies may arise in the policy specification. In this paper we provide a comprehensive set of QoS policies for managing Differentiated Services (DiffServ) networks, and classify the possible conflicts that can arise between them. We demonstrate the use of Event Calculus and formal reasoning for the analysis of both static and dynamic conflicts in a semi-automated fashion. In addition, we present a conflict analysis tool that provides network administrators with a user-friendly environment for determining and resolving potential inconsistencies. The tool has been extensively tested with large numbers of policies over a range of conflict types.

A method to determine entry and exit points or paths of DDoS attack traffic flows into and out of network domains is proposed. We observe valid source addresses seen by routers from sampled traffic under non-attack conditions. Under attack conditions, we detect route anomalies by determining which routers have been used for unknown source addresses, to construct the attack paths. We consider deployment issues and show results from simulations to prove the feasibility of our scheme. We then implement our Traceback mechanism in C++ and more realistic experiments are conducted. The experiments show that accurate results, with high traceback speed of a few seconds, are achieved. Compared to existing techniques, our approach is non-intrusive, not requiring any changes to the Internet routers and data packets. Precise information regarding the attack is not required allowing a wide variety of DDoS attack detection techniques to be used. The victim is also relieved from the traceback task during an attack. The scheme is simple and efficient, allowing for a fast traceback, and scalable due to the distribution of processing workload.

The aim of human activity recognition is to identify what a user or a group of users are doing at a given point in time, for example travelling or working. Activity recognition plays an important role in mobile and ubiquitous computing both as a goal in itself and as an intermediate task in the design of advanced applications. Virtually all existing activity recognition systems for mobile phones base their predictions on location cues. This approach forces the user to disclose personal information such as her home or work area. In this paper, we present a novel activity recognition system called TRAcME (temporal recognition of activities for mobile environments) which recognises generic human activities from large windows of context, Allenpsilas temporal relations and anonymous landmarks. Unlike existing systems, TRAcME handles simultaneous activities and outputs activities which are consistent with each other at the scale of a userpsilas day.

Body sensor networks (BSNs) have become a promising technology for healthcare, in which biosensors continuously monitor physiological parameters of a user. Distinct from conventional sensor networks for environmental monitoring, such networks need to be adaptive and can therefore be easily managed. In addition, security becomes a necessity. To this end, we design a policy system that implements policy-driven management on the sensor level. Biosensor adaptability is realized through support of dynamic loading, enabling and disabling of policies without shutting down nodes. In addition, fine-grained access control becomes possible through authorization policies on biosensors. Design and implementation details of the policy system are presented. Experimental results demonstrate that the policy system is viable and can accelerate application development of biosensor networks for healthcare.

Body sensor networks (BSNs) for healthcare put more emphasis on security and adaptation to changes in context and application requirement. Policy-based management enables flexible adaptive behaviour by supporting dynamic loading, enabling and disabling of policies without shutting down nodes. This overcomes many of the limitations of sensor operating systems, such as TinyOS, which do not support dynamic modification of code. Alternative schemes for network adaptation, such as networking programming, suffer from high communication cost and operational interruption. In addition, the policy-driven approach enables fine-grained access control through specifying authorization policies. This paper presents an efficient policy system called finger which enables policy interpretation and enforcement on distributed sensors to support sensor level adaptation and fine-grained access control. It features support for dynamic management of policies, minimization of resources usage, high responsiveness and node autonomy. The policy system is integrated as a TinyOS component, exposing simple, well-defined interfaces which can easily be used by application developers. The system performance in terms of processing latency and resource usage is evaluated.

Today's high-end mobile phones commonly include one or two digital cameras. These devices, also known as cameraphones, allow their owners to take photographs anywhere, at any time with practically no cost. As a result, many urban dwellers are photographed everyday without even being aware of it. Although in many countries, legislation recognises the right of people to veto the dissemination of their image, snapshots including recognisable passers-by often end up on photo-sharing websites. In this paper, we present a cooperative system for cameraphones which automatically anonymises faces of people photographed involuntarily. Our system, called BlurMe, uses Bluetooth awareness to inform a photographer's cameraphone when people around this photographer do not wish for their picture being taken. It then identifies subjects on the photograph and anonymises other people's faces. BlurMe was tested on 876 face regions detected on 150 real-life photographs collected from a photo-sharing website and manually labelled for subject faces. The system achieved very promising results on photographs with up to three subjects.

A method to determine entry points and paths of DDoS attack traffic flows into network domains is proposed. We determine valid source addresses seen by routers from sampled traffic under non-attack conditions. Under attack conditions, we detect route anomalies by determining which routers have been used for unknown source addresses to construct the attack paths. We show results from simulations to detect the routers carrying attack traffic in the victim's network domain. Our approach is non-intrusive, not requiring any changes to the Internet routers and data packets. Precise information regarding the attack is not required allowing a wide variety of DDoS attack detection techniques to be used. The victim is also relieved from the traceback task during an attack. Our algorithm is simple and efficient, allowing for a fast traceback and the method is scalable due to the distribution of processing workload.

Abstract Future e‐Health systems will consist of low‐power on‐body wireless sensors attached to mobile users that interact with an ubiquitous computing environment to monitor the health and well being of patients in hospitals or at home. Patients or health practitioners have very little technical computing expertise so these systems need to be self‐configuring and self‐managing with little or no user input. More importantly, they should adapt autonomously to changes resulting from user activity, device failure, and the addition or loss of services. We propose the Self‐Managed Cell (SMC) as an architectural pattern for all such types of ubiquitous computing applications and use an e‐Health application in which on‐body sensors are used to monitor a patient living in their home as an exemplar. We describe the services comprising the SMC and discuss cross‐SMC interactions as well as the composition of SMCs into larger structures. Copyright © 2007 John Wiley & Sons, Ltd.

This paper describes a reconfigurable architecture based on field-programmable gate-array (FPGA) technology for monitoring and analyzing network traffic at increasingly high network data rates. Our approach maps the performance-critical tasks of packet classification and flow monitoring into reconfigurable hardware, such that multiple flows can be processed in parallel. We explore the scalability of our system, showing that it can support flows at multi-gigabit rate; this is faster than most software-based solutions where acceptable data rates are typically no more than 100 million bits per second.

The paper describes a Non-Intrusive IP traceback scheme which uses sampled traffic under non-attack conditions to build and maintains caches of the valid source addresses transiting network routers. Under attack conditions, route anomalies are detected by determining which routers have been used for unknown source addresses, in order to construct the attack graph. Results of simulation studies are presented. Our approach does not require changes to the Internet routers or protocols. Precise information regarding the attack is not required allowing a wide variety of DDoS attack detection techniques to be used. Our algorithm is simple and efficient, allowing for a fast traceback and the scheme is scalable due to the distribution of processing workload.

Body sensor networks consisting of low-power on- body wireless sensors attached to mobile users will be used in the future to monitor the health and well being of patients in hospitals or at home. Such systems need to adapt autonomously to changes in context, user activity, device failure, and the availability or loss of services. To this end, we propose a policy- based architecture that uses the concept of a Self-Managed Cell (SMC) to integrate services, managed resources and a policy interpreter by means of an event bus. Policies permit the declarative specification of adaptation strategy for self- configuration and self-management. We present the design and implementation of the SMC and describe its potential use in a scenario for management of heart monitoring. Preliminary performance measurements are also presented and discussed.

Policy-based dynamic resource management may involve interaction between independent decision-making components which can lead to conflicts. For example, conflicts can occur between the policies for allocating resources and those setting quotas for users or classes of service. These policy conflicts cannot be detected by static analysis of the policies at specification-time as the conflicts arise from the current state of the resources within the system and so can only be detected at run-time. In this paper we use policies related to quality of service (QoS) provisioning for configuring differentiated services (DiffServ) networks to illustrate techniques for the dynamic detection and resolution of conflicts. Configuration includes implementing network provisioning decisions, performing admission control, and adapting bandwidth allocation dynamically according to emerging traffic demands. We identify possible conflicts between policies that manage the allocation of resources, and we also investigate conflicts that may arise between these policies and higher-level directives refined at the dynamic resource management level, acting as constraints. The paper shows how event calculus can be used to detect conflicts, focusing on the ones that emerge at run-time, and provides an approach for specifying policies to automate conflict resolution. The latter is demonstrated through our initial implementation of a dynamic conflict analysis tool

Policy-based management provides the ability to dynamically re-configure DiffServ networks such that desired Quality of Service (QoS) goals are achieved. This includes network provisioning decisions, performing admission control, and adapting bandwidth allocation dynamically. QoS management aims to satisfy the Service Level Agreements (SLAs) contracted by the provider and therefore QoS policies are derived from SLA specifications and the provider's business goals. This policy refinement is usually performed manually with no means of verifying that the policies written are supported by the network devices and actually achieve the desired QoS goals. Tool support is lacking and policy refinement has rarely been addressed in the literature. This paper extends our previous approach to policy refinement and shows how to apply it to the domain of DiffServ QoS management. We make use of goal elaboration and abductive reasoning to derive strategies that will achieve a given high-level goal. By combining these strategies with events and constraints, we show how policies can be refined, and what tool support can be provided for the refinement process using examples from the QoS management domain. The approach presented here can be used in other application domains such as storage area networks or security management.

Policy-based management provides the ability to dynamically re-configure DiffServ networks such that desired quality of service (QoS) goals are achieved. This includes network provisioning decisions, performing admission control, and adapting bandwidth allocation dynamically. QoS management aims to satisfy the service level agreements (SLAs) contracted by the provider and therefore QoS policies are derived from SLA specifications and the provider's business goals. This policy refinement is usually performed manually with no means of verifying that the policies written are supported by the network devices and actually achieve the desired QoS goals. Tool support is lacking and policy refinement has rarely been addressed in the literature. This paper extends our previous approach to policy refinement and shows how to apply it to the domain of DiffServ QoS management. We make use of goal elaboration and abductive reasoning to derive strategies that achieves a given high-level goal. By combining these strategies with events and constraints, we show how policies can be refined, and what tool support can be provided for the refinement process using examples from the QoS management domain. However, the approach presented here can be used in other application domains such as storage area networks or security management.

The greater sophistication and availability of mobile computing devices is enabling the application of computing to new tasks and applications to be experienced in a wide range of contexts. To facilitate such applications it is necessary to adapt the applications and the data they display to operate within the limitations of the context of use, take advantage of the strengths of the devices and best support the users in their tasks. A part of the solution to this issue is the description of the data available to the applications. Meta data may describe the structure and properties of information and data. We achieve this by separating the semantic elements of the information from the syntactic variants which realise them in order to form documents. In this paper we describe a new meta data model which can encode this description. We provide example meta data and illustrate how this may lead to better application usability than current simplistic or constrained approaches, through contextual mediation.

We describe a framework for capturing firewall requirements as high-level descriptions based on the policy specification language Ponder. The framework provides abstraction from hardware implementation while allowing performance control through constraints. Our hardware compilation strategy for such descriptions involves a rule reduction step to produce a hardware firewall rule representation. Three main methods have also been developed for resource optimization: partitioning; elimination; and sharing. A case study involving five sets of filter rules indicates that it is possible to reduce 67-80% of hardware resources over techniques based on regular content-addressable memory, and 24-63% over methods based on irregular content-addressable memory.

High-performance firewalls can benefit from the increasing size, speed and flexibility of advanced reconfigurable hardware. However direct translation of conventional firewall rules in a router-based rule set often leads to inefficient hardware implementation. Moreover, such lowlevel description of firewall rules tends to be difficult to manage and to extend. We describe a framework, based on the high-level policy specification language Ponder for capturing firewall rules as authorization policies with user-definable constraints. Our framework supports optimisations to achieve efficient utilisation of hardware resources. A pipelined firewall implementation developed using this approach running at 10 MHz is capable of processing 2.5 million packets per second, which provides similar performance to a version without optimisation and is about 50 times faster than a software implementation running on a 700 MHz PIII processor.

The management of policies in large-scale systems is complex because of the potentially large number of policies and administrators, as well as the diverse types of information that need to be managed. Appropriate tool support is essential to make management practical and feasible. In this paper we present the implementation of an integrated toolkit for the specification, deployment and management of policies specified in the PONDER language. PONDER policies provide a powerful framework for managing distributed systems which includes explicit domain-based subject and target specifications as well as a flexible life-cycle and deployment model. Domains, implemented using LDAP directories, are used for storing policies and grouping resources, people, and the entities which implement policy, thus facilitating the automated dissemination of policy information. The toolkit presented in this paper comprises: a policy compiler, used to generate implementation code for heterogeneous management and security platforms, a hyperbolic tree viewer for efficient manipulation of the domain structure and effective navigation across the domains, and various tools for deploying and managing the policy life-cycle.

Policies are rules that govern the choices in behaviour of a system. Security policies define what actions are permitted or not permitted, for what or for whom, and under what conditions. Management policies define what actions need to be carried out when specific events occur within a system or what resources must be allocated under specific conditions. There is considerable interest in the use of policies for the security and management of large-scale networks and distributed services. Existing policy work has focussed on specification, information models and application-specific policy enforcement. We address the important goal of providing a general-purpose deployment model for policies that is independent of the underlying policy enforcement mechanisms and can be employed in mixed policy environments. In this paper, we present a deployment model that is object-oriented and addresses the instantiation, distribution and enabling of policies as well as the disabling, unloading and deletion of policies. The model defines objects for policies, for domains, and for the policy enforcement agent and outlines the interactions needed between them. The model also caters for changes in the memberships of domains since such changes also effect policy enforcement. The model forms part of the run-time support for Ponder; a new policy language that combines structuring ideas from object-oriented languages with a common set of policy basic types.

Display characteristics, network Quality of Service, and the user's current task all exhibit a wide range of variation when users interact with mobile and ubiquitous devices. It is desirable to enable applications to adapt to these variations. The user's experience in interacting with the application can be significantly enhanced by adapting the data presented. However, we find that naive degradation of data can quickly result in an unacceptable presentation. In this paper we present a means of describing compound documents and preferences according to the semantics of the data, and an algorithm for performing a selection amongst the offered data based on these descriptions. Our model of the user's preferences is more descriptive than most common specifications used for Webbased applications. These have been implemented for a map viewing application, along with application level network resource management. We present test results for adapting to network bandwidth and a download deadline. We show the technique is applicable over two orders of magnitude in bandwidth variation, and successful in meeting deadlines. By degrading the data presented in sympathy with the user's needs, the degradation has less impact on the user for any given benefit in download time than arbitrary selection. Keywords Adaptive application, quality of service. 1

This paper introduces the Ponder language for specifying distributed object enterprise concepts. Ponder, is a declarative language, which permits the specification of policies in terms of obligations, permissions and prohibitions and provides the means for defining roles, relationships and their configurations in nested communities. Ponder provides a concrete representation of most of the concepts of the Enterprise Viewpoint. The design of the language incorporates lessons drawn from several years of research on policy for security and distributed systems management as well as policy conflict analysis. The various language constructs are presented through a scenario for the operation, administration and maintenance of a mobile telecommunication network.

Describes a flexible architecture for building the protocols required to allow interaction between distributed objects in a CORBA environment. A key feature of the architecture is its ability to select the elements of a protocol stack dynamically at bind-time depending on the properties of the interface being accessed. This permits multiple object-invocation protocols to coexist such that a system may support local, intra-ORB (object request broker) and inter-ORB protocols and allows the selection of the most appropriate protocol at run-time. In addition, the architecture is capable of supporting "non-standard" interaction protocols such as multimedia streams. This paper outlines the architectural principles used and describes an efficient implementation of the CORBA Internet Inter-ORB Protocol.